Libcoap CVE-2026-29013

Exploitation requires the target libcoap instance to be compiled with OSCORE support enabled and built in release mode with NDEBUG defined (removing assert checks). The OSCORE feature must be actively enabled in the running CoAP service configuration, not just compiled in. The vulnerable code path is triggered specifically during OSCORE Appendix B.2 CBOR unwrapping operations when processing incoming CoAP requests with OSCORE options or during OSCORE negotiation phase responses. Successful exploitation does NOT require the attacker to possess valid OSCORE encryption keys or pre-existing authentication credentials-the vulnerability is triggered during initial packet parsing before cryptographic validation occurs. Exploitation is limited to libcoap deployments where CoAP endpoints are network-accessible to the attacker (typically UDP ports 5683 for CoAP or 5684 for CoAPS). Deployments using libcoap without OSCORE support compiled in, or debug builds where assert() remains active, are not vulnerable.

Real-world risk is HIGH despite absence of confirmed active exploitation. CVSS 4.0 score of 8.8 reflects network attack vector (AV:N), low complexity (AC:L), no prerequisites (AT:N), and no authentication required (PR:N), indicating trivial exploitation against internet-facing CoAP endpoints. The high confidentiality impact (VC:H) and high availability impact (VA:H) align with memory corruption consequences-information disclosure through OOB reads and potential denial-of-service or code execution through heap overflow. EPSS data not provided, but the combination of unauthenticated network exploitation, clear vulnerable code path (commit b7847c4 shows exact fix), and widespread libcoap deployment in IoT infrastructure suggests moderate-to-high likelihood of weaponization once researchers analyze the patch diff. SSVC technical impact is TOTAL (memory corruption enabling potential RCE). The attack is AUTOMATABLE (no user interaction required, UI:N) once exploit code is developed. Primary risk differential: OSCORE is not universally enabled-only libcoap deployments using OSCORE encryption are vulnerable. Default libcoap builds without OSCORE support are NOT affected. Organizations must verify if their libcoap instances compile with OSCORE support and whether OSCORE negotiation is reachable from untrusted networks.

An attacker identifies an IoT gateway running libcoap v4.3.4 with OSCORE enabled and exposed on UDP port 5684. The attacker crafts a CoAP request containing a malformed OSCORE option with manipulated CBOR-encoded length fields designed to bypass removed assert() checks. When the gateway's get_byte_inc() function processes the CBOR unwrapping during OSCORE negotiation, it reads beyond allocated buffer boundaries, leaking heap memory contents. By carefully controlling the length field to trigger integer wraparound in subsequent allocation size computation, the attacker causes a small buffer to be allocated while large data is written, achieving heap buffer overflow and potentially executing arbitrary code in the context of the CoAP service process.